Serverless Backends

A signing backend that lives outside the shared host

The private key sits in a .env file one directory above public_html, exactly where the shared-host tutorials put it. A single server compromise reads that key in the same step as the database password, and whoever holds the key signs anything. On a shared host, secrets and application code live on the same filesystem — so the real fix is to move the secret somewhere the shared host can only reach through an authenticated door.

This book builds that door. At the center is an AWS Lambda function that signs a transaction with a private key managed by KMS and encrypted at rest, fronted by an API Gateway endpoint the PHP layer calls over HTTPS. Two checks guard every invocation: an IP whitelist that admits only the shared host, and an API secret validated in a header. SNS publishes a notification when a sale completes.

Eight chapters build one working backend in order — KMS, Lambda, API Gateway, hardening, SNS, the PHP caller, operations, and the reusable pattern. Every piece comes from a real deployed system.

Eight chapters, one complete backend

• KMS key setup — Creating the key, setting the key policy, and understanding what KMS encrypts at rest vs. what the Lambda function handles in memory.
• Lambda function design — The signing function itself: how it calls KMS, what it validates before signing, and how it returns the signed result to the caller.
• API Gateway configuration — Standing up the HTTPS endpoint, mapping it to the Lambda function, and configuring the stage for production use.
• IP whitelist — Restricting the endpoint to the shared host’s IP address so only your server can trigger the signing function, not arbitrary callers.
• API secret header — A second layer of authentication validated inside the Lambda function before the signing call is made.
• SNS notification — Publishing a sale event to an SNS topic when the signing completes, giving you an audit trail and optional downstream integrations.
• The PHP caller — The shared-host side: building the HTTPS request, passing the API secret, validating the response, and handling errors without leaking details.
• Operations and the reusable pattern — Monitoring the Lambda, rotating the API secret, and extracting the pattern for signing other transaction types.

A preview

The shared host does not need to know the private key. It needs to make a request that causes something else to sign — something the shared host cannot read, cannot ssh into, and cannot compromise by reading the filesystem. Lambda is that something else. KMS is what keeps the key away from the function itself.

PHP developers on shared hosting with a signing requirement

This book is for developers who run PHP on shared hosting and need to sign something — a blockchain transaction, a webhook payload, a document — without keeping the private key on the same filesystem as the rest of the application. Familiarity with PHP and basic web hosting is assumed. The AWS components are built step by step from scratch.

A longer excerpt is available to newsletter subscribers.

Buy Ebook on Amazon